Use keyed hashing for session data, remove duplicate code

[Nir Soffer <nirs@…>]

Use hmac instead of md5 to create a digest of session data. Using hmac is probably more secure than the home built md5 implementation. Also, the current implementation uses hexdigest() when digest() is just fine.

While replacing the hash, extract the digest code to a new function to remove duplicate code.

Issues:

• Old session will be invalidated with this patch

[Nir Soffer <nirs@…>]

patch

[Malcolm Tredinnick]

I don't think the churn is worth it here, since invalidating existing sessions is a little annoying. If somebody constructs a string that collides with our MD5 hash, there's not a lot they can do, since they really need the right string to be able to work out what's in the session. MD5 is vulnerable to collisions, not reverse-engineering.